Embedding security posture in network traffic

Patent metadata

Field	Value
Publication number	US-9756047-B1
Application number	US-201414517723-A
Country	US
Kind code	B1
Filing date	Oct 17, 2014
Priority date	Oct 17, 2013
Publication date	Sep 5, 2017
Grant date	Sep 5, 2017

Abstract

Embedding security posture in network traffic is disclosed. Security posture information is received. The security posture information is embedded into a message. The message including the security posture information is sent from a mobile device to a service node. The service node uses the security posture information to validate the mobile device to access a service. The service accesses the service based at least in part on the validation.

First claim

What is claimed is:

1. A method, comprising:
receiving from a device management server security posture information that includes a posture value;
embedding the security posture information into a message;
sending the message including the security posture information from a mobile device to a service node, wherein the service node is configured to:
negotiate with the device management server regarding a data structure associated with the security posture information;
validate the mobile device to access a service using the security posture information, wherein the data structure includes a mapping of one or more security postures to corresponding posture values; and
in the event the security posture information does not validate the mobile device based on the posture value the service node is configured to communicate with the device management server to validate the mobile device; and

accessing the service based at least in part on the validation.

2. The method of claim 1 , further comprising:
sending, from the mobile device to the device management server, state information, wherein the state information is used at the device management server to generate the security posture information.

3. The method of claim 2 , wherein the state information includes one or more of mobile device state information, application inventory information, and policy state information.

4. The method of claim 2 , wherein sending the state information comprises sending the state information from a management agent on the mobile device to the device management server.

5. The method of claim 2 , wherein the device management server is configured to perform the steps of:
receiving the state information;
determining a posture of the mobile device at least in part by applying rules to the state information;
generating the security posture information including a security posture value indicating the security posture of the mobile device; and
sending the security posture information to the mobile device.

6. The method of claim 1 , further comprising:
determining a posture of the mobile device based at least in part on state information; and
generating the security posture information indicating the posture of the mobile device.

7. The method of claim 6 , wherein determining the posture is performed at a management agent on the mobile device, and further comprising sending the security posture information to a managed application on the mobile device.

8. The method of claim 6 , wherein determining the posture is performed at a virtual private network client on the mobile device.

9. The method of claim 1 , wherein the steps of receiving, embedding, sending, and accessing are performed at least in part at a virtual private network client on the mobile device.

10. The method of claim 1 , wherein receiving the security posture information includes:
receiving the security posture information at a mobile device management agent; and
providing the security posture information to a managed application.

11. The method of claim 10 , wherein the managed application embeds the security posture information into the message.

12. The method of claim 1 , wherein the embedding step includes;
embedding the security posture information into a header of a hypertext transfer protocol (HTTP) message.

13. The method of claim 1 , wherein the embedding step includes:
embedding the security posture information into a Wi-Fi user profile associated with the mobile device.

14. The method of claim 1 , wherein the embedding step includes:
adding the security posture information to a portion of the message, wherein the message includes information to be sent to the service node irrespective of the security posture information.

15. The method of claim 1 , wherein the security posture information includes one or more of mobile device posture information, timestamp information, and a service identifier associated with the service node.

16. The method of claim 1 , wherein the security posture information includes a first set of security posture information generated at the mobile device and a second set of security posture information generated at a device management server.

17. The method of claim 16 , wherein the service node is configured to perform the steps of:
selecting a set of security posture information based at least in part on timestamp information included in the sets of security posture information; and
analyzing the selected set of security posture information.

18. The method of claim 1 , wherein the security posture information is encrypted at the device management server using encryption information associated with the service node.

19. The method of claim 18 , wherein the service node is configured to perform the steps of:
receiving the message including the security posture information; and
using the encryption information associated with the service node to extract the security posture information from the message.

20. The method of claim 1 , wherein the service node is configured to perform the steps of:
analyzing the security posture information; and
providing the mobile device access to the service based at least in part on the analysis of the security posture information.

21. The method of claim 20 , wherein analyzing the security posture information includes:
applying a policy to one or more of a security posture value and a security posture expiration time included in the security posture information;
determining that the mobile device is validated to access the service based at least in part on the application of the policy; and
providing the mobile device access to the service based at least in part on the determination.

22. The method of claim 1 , wherein the service node is configured to perform the steps of:
analyzing the security posture information; and
denying access the mobile device access to the service based at least in part on the analysis of the security posture information.

23. The method of claim 22 , wherein the service node is further configured to perform the step of providing information to the mobile device including operations to be performed to gain access to the service.

24. The method of claim 1 , wherein the service node registers the service with device management server at least in part by determining one or more of a service identifier associated with the service, encryption information associated with the service node, a communication protocol, one or more security values, and a security posture expiration period.

25. The method of claim 1 , wherein the security posture information is embedded into the message based at least in part on a frequency requirement associated with the service.

26. A system, comprising:
a processor; and
a memory coupled with the processor, wherein the memory is configured to provide the processor with instructions which when executed cause the processor to:
receive from a device management server security posture information that includes a posture value;
embed the security posture information into a message;
send the message including the security posture information from a mobile device to a service node, wherein the service node is configured to:
negotiate with the device management server regarding a data structure associated with the security posture information;
validate the mobile device to access a service usin

Assignees

• Mobile Iron Inc

Inventors

• Batchu Suresh Kumar
• Kim Mansu

Classifications

• H04W12/02

  Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII] · CPC title

• H04L63/0876 Primary

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04L63/0272

  Virtual private networks · CPC title

• G06F21/44

  Program or device authentication · CPC title